Effective Date: 2026-09-24

Last Updated: 2026-09-24

Your privacy is important to us. This Privacy Policy (the “Policy”) describes how Joyin US Corp (the “Company”, “us”, “we”, or “our”) may collect, use, and disclose your personal data when you visit https://joyin.com/ (the “Website”) and the products, features, materials, and services we offer (collectively with the Website, the “Services”). This Policy also describes the choices and rights you have with respect to your personal data.

This Policy applies to information we collect on the Website and through your use of the Services generally (including when you create or log in to a customer account, place an order, or contact customer service), and through communications between you and the Website (including email, text, and other electronic messages). This Policy does not apply to websites and services that are owned and operated by third parties, including third-party marketplaces (such as Amazon) through which our products may also be sold; such marketplaces act as independent data controllers, and we encourage you to review their privacy policies.

Please take some time to read this Policy in order to ensure you understand and are comfortable with our use and disclosure of your personal data. If you do not agree to any of the provisions of this Policy, you should not use the Services.

1. Data Controller’s Details.

The Company is the data controller of your personal data provided to, or collected by or for, or processed in connection with, the Services. The Company’s registered address is at 315 W Elliot Rd, STE 107-168 Tempe, AZ 85284, United States, and we can be contacted using the details provided in the “Contact Us” section below.

2. Personal Data We Collect.

Personal data, or personal information, is any information about an individual which could, alone or together with other information, personally identify them or otherwise be reasonably linked or connected with them. It does not include aggregated, non-personally identifying information that does not identify an individual or cannot otherwise be reasonably linked or connected with them. We may use such aggregated, non-personally identifying information for research purposes and to operate, analyze, improve, and optimize the Services.

Personal data we collect is related to providing the Services and falls into three main categories: (1) personal data you voluntarily provide us; (2) personal data we collect automatically; and (3) personal data we collect from other sources.

2.1 Personal Data That You Voluntarily Provide Us.

We collect personal data that you knowingly choose to disclose. This may include:

(a) Account and Contact Information. Such as your name, billing and shipping address, phone number, email address, and ZIP or postal code. This includes data you provide when you create or log in to a customer account, save contact details or addresses to your account profile, sign up to receive our newsletters, coupons, or other marketing communications, or make a request for customer service.

(b) Payment and Transaction Information. Such as your order details and purchase history, any discount codes or gift card information you redeem, and your billing, shipping, and contact details. Payments on the Website are processed by third-party payment processors (including the payment services integrated into our e-commerce platform and PayPal). We do not collect or store your full payment card number; we may receive limited payment information from our payment processors, such as the card type, the last four digits of your card number, and payment confirmation. If you choose to log in or check out using a third-party accelerated checkout service (such as Shop Pay, operated by Shopify), your login credentials and payment information are collected and processed by that provider under its own privacy policy.

(c) Communications. Such as records and copies of your email messages together with your email address and our responses; records of your phone number and phone calls with us; and records of the messages and any attachments you choose to submit through the online chat or contact forms available on the Website.

(d) Other Information. Such as when you fill in a form, respond to surveys, participate in promotions, enter search queries on the Website, or otherwise communicate with the Company or share your experience with us.

2.2 Personal Data We Collect Automatically.

When you use the Services, we automatically collect personal and other data. This may include:

(a) Device and Online Usage Information. Such as details about how you have used the Services, including the pages or content you view or engage with, the items you view or place in your shopping cart, the pages or sources that refer you to the Website, information about your engagement with our emails (such as whether you open or click them), IP address, access dates and times, device type, operating system, browser type and language, unique identifiers, and other actions on the Services.

(b) Transactional Information. Such as information about your transactions on the Services, such as the date, time, and amount charged.

(c) Geolocation Information. Approximate location information (such as your city, state or region, postal code, or country) that we infer from your IP address, which we use for purposes such as fraud prevention, order processing, analytics, and delivering the Services. We do not collect precise GPS location from your device.

Some of this data is collected using cookies, pixels, and similar technologies; please see “Use of Cookies and Other Online Tracking Technologies” below for more details.

2.3 Personal Data We Collect From Other Sources.

We may receive data about you from our service providers and the tools we use to operate the Services, such as our e-commerce platform provider (for example, fraud-screening results and order risk assessments), our payment processors (for example, payment confirmations), and our analytics and advertising providers (for example, aggregated campaign and audience measurement data). We do not purchase personal data about you from data brokers, and we do not collect data about you from social login or authentication partners. We protect this data according to the practices described in this Policy, plus any additional restrictions imposed by the source of the data.

3. How We Use Your Personal Data.

3.1 General Use of Your Personal Data.

We generally use your data for business and commercial purposes, including to provide the Services you request, to perform customer service functions, for security and fraud prevention, for marketing and promotional purposes, and to perform analytics, as explained in more detail below.

3.2 Legal Bases for Processing Under the GDPR.

We will only use your personal data if and to the extent that applicable law allows. Where the General Data Protection Regulation (the “GDPR”) or the United Kingdom General Data Protection Regulation (the “UK GDPR”) applies to our processing of your personal data, we process your personal data under the following bases:

(a) Performance of a Contract. Where the processing is necessary for the performance of a contract with you, such as to process and fulfill an order you place with us.

(b) Legitimate Interests. If we (or a third party) have a legitimate interest which is not overridden by your interests or your rights and freedoms.

(c) Legal Requirement. Where the processing is necessary in connection with a legal obligation.

(d) Consent. You have given your consent (where necessary) to such use.

(e) Vital Interest. Where the processing is necessary to protect the health, safety, or vital interests of any person.

3.3 Purposes of Use With Legal Bases.

We may use the personal data we collect about you in a variety of ways, including:

(a) Providing Services and Support to You. Specifically, we use personal data to provide the Services to you, including to process and fulfill your orders, arrange delivery, and handle returns, refunds, and after-sales matters; to create, maintain, and authenticate your customer account and provide you with account features such as saved addresses and marketing preferences; and for troubleshooting, technical, and customer service and support purposes. The legal bases for the processing of your personal data for these purposes include performance of a contract, legitimate interests, and legal requirement.

(b) Communicating With You. Specifically, we use personal data to communicate with you about your order, purchase, or account (including order, delivery, and service notifications and other Services-related announcements), and to inform you about important changes to the Services. The legal bases for the processing of your personal data for these purposes include performance of a contract, legitimate interests, and legal requirement.

(c) Marketing and Promotions. Specifically, we use personal data to send you newsletters, offers, promotions, and other information about us or the Services, and reminders about items you have left in your shopping cart, subject to your consent where required by applicable law; and to create, customize, and deliver advertising for our products and Services, including by matching your contact information with users of third-party advertising platforms (such as Google and Meta) and serving remarketing advertisements to you on other websites and applications. The legal bases for the processing of your personal data for these purposes include consent and legitimate interests.

(d) Analytics, Personalization, and Improvement. Specifically, we use personal data to operate, maintain, improve, personalize, and analyze the Services; to monitor and analyze trends, usage, and activities; and to develop, test, troubleshoot, and improve new products, services, and features, including by conducting surveys and research. The legal bases for the processing of your personal data for these purposes include legitimate interests and consent (where required for the use of non-essential cookies and similar technologies).

(e) Protecting Legal Rights and Preventing Misuse. Specifically, we use personal data to protect the Services and our business operations, including to detect, investigate, or take action regarding security breaches, fraud, and other illegal activities; to investigate, enforce, and prevent violations of our policies, our Terms of Use, and other agreements; and as otherwise necessary to establish, protect, and defend our legal rights, including for billing and collection. The legal bases for the processing of your personal data for these purposes include performance of a contract, legitimate interests, and legal requirement.

(f) Complying with Legal Obligations. Specifically, we use personal data to comply with the law and to respond to legal process or enforcement requests. The legal bases for the processing of your personal data for these purposes include legal requirement and legitimate interests.

(g) General Business Operations. Specifically, we use personal data where necessary for the administration of our general business, accounting, recordkeeping, and legal functions, and to maintain appropriate records for internal administrative purposes. The legal bases for the processing of your personal data for these purposes include legitimate interests and legal requirement.

4. How We Share Your Personal Data.

We may share your personal data with third parties under one of the following circumstances:

(a) Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates in furtherance of the purposes set out in this Policy. Our affiliates include entities located outside the United States that provide technical support, server deployment and maintenance, order management, data analysis, and customer service support for the Services. Please see “International Data Transfers” below.

(b) Service Providers. We may share your data with third-party vendors, consultants, and other service providers that provide us with support services, such as our e-commerce platform and website hosting providers, cloud service providers, payment processors, warehousing, fulfillment, and delivery partners, customer service tools, and email marketing service providers, and who are bound by contractual obligations to keep personal data confidential and use it only for the purposes for which we disclose it to them.

(c) Advertising and Analytics Partners. We may share your data with third-party advertising and analytics partners (such as Google and Meta), through cookies, pixels, and similar technologies deployed on the Website, and through the audience-matching uploads described in “How We Use Your Personal Data” above. Where required by applicable law, non-essential cookies and similar technologies are used only in accordance with the choices you make through the cookie banner or cookie settings tool on the Website.

(d) Change in Control or Sale. We may share your data if we are involved in a merger, corporate transaction, or another situation involving the transfer of some or all of our business assets (whether as a going concern or as part of a bankruptcy, liquidation, or similar proceeding), with business entities or people involved in the negotiation or transfer.

(e) Compliance with Laws. We may be required to share your data to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.

(f) With Your Consent. We share data about you with other companies if you give us permission or direct us to share such data.

(g) Aggregated Data. We may share aggregated data (i.e., data about our users that we render in such a way that it no longer identifies or references an individual user) and other pseudonymized information for regulatory compliance, industry and market analysis, demographic profiling, marketing and advertising, and other business purposes.

5. Use of Cookies and Other Online Tracking Technologies.

The Company uses cookies, web beacons (also known as “pixel tags”), analytics devices, and similar technologies (some of which are operated by third parties) to make interactions with the Services easy and meaningful. You can accept or reject non-essential cookies (such as statistics and marketing cookies), and change your choices at any time, through the cookie banner or cookie settings tool on the Website. We keep records of the cookie preferences and opt-out choices you make (including opt-out preference signals we receive) so that we can honor and document them. For more details about how we use these technologies and the specific cookies and similar technologies placed through the Website, please visit our Cookies Policy (https://joyin.com/pages/cookies-policy).

6. Your Choices Regarding Your Personal Data.

We do our best to give you as much choice as possible regarding the amount of data you provide to us, and the control you have over that data.

(a) Cookies. Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. Please note that if you set your browser to disable cookies, the Website may not work properly. Similarly, your browser settings may allow you to clear your browser web storage. In addition, you may manage your cookie preferences at any time through the cookie banner or cookie settings tool on the Website, where you can accept or reject non-essential cookies (such as statistics and marketing cookies).

(b) Marketing Communications. You can opt out of receiving certain marketing or promotional communications from us at any time by (i) adjusting the marketing preferences in your customer account profile on the Website; (ii) following the opt-out or unsubscribe instructions in the promotional emails we send you; or (iii) sending us an email using the contact information in the “Contact Us” section below. If you have an account for the Services, we may still send you transactional communications, including emails about your account or purchases.

(c) Targeted Online Advertising. We or one of our authorized partners may place or read cookies on your device when you visit the Website for the purpose of serving you targeted advertising (also referred to as “online behavioral advertising” or “interest-based advertising”). For more information about analytics and advertising cookies and how you can opt out, you can visit the Network Advertising Initiative’s opt-out page (https://www.networkadvertising.org/choices/), the Digital Advertising Alliance’s opt-out page (https://www.aboutads.info/choices/), or, if you are located in the European Union or the United Kingdom, http://www.youronlinechoices.eu.

(d) U.S. State Privacy Rights. If you are a California resident, please see the “APPENDIX — CALIFORNIA PRIVACY NOTICE” below for additional disclosures and for how to exercise your rights under California law, including your right to opt out of the “sale” or “sharing” of personal information through the “Do Not Sell or Share My Personal Information” link in the footer of the Website, the cookie banner or cookie settings tool, or an opt-out preference signal such as the Global Privacy Control (“GPC”). If you are a resident of another U.S. state with a comprehensive consumer privacy law, you may exercise the rights available to you under that law (which may include access, correction, deletion, portability, opting out of targeted advertising, and appeal) by contacting us as described in the “Contact Us” section below.

7. Your Rights Regarding Your Personal Data.

Where the GDPR or the UK GDPR applies to our processing of your personal data, you have certain rights in relation to your personal data. As available and except as limited under applicable law, the rights afforded to individuals are:

(a) Right To Access. The right to be informed of, and request access to, the personal data we process about you.

(b) Right to Rectification/Correction. The right to request that we amend or update your personal data where it is incorrect or incomplete.

(c) Right to Erasure/Deletion. The right to request that we delete certain personal data we hold about you.

(d) Right to Data Portability. The right to request a copy of your personal data in electronic format, and the right to request that we transfer such data to a third party of your choice.

(e) Right to Restrict. The right to request that we restrict the way we process and disclose certain of your personal data.

(f) Right to Object. The right to object to our processing of your personal data where we are relying on a legitimate interest (or those of a third party), or where we are processing your personal data for direct marketing purposes.

(g) Right to Withdraw Your Consent. The right to withdraw your consent at any time (to the extent we base processing on consent), without affecting the lawfulness of the processing based on such consent before its withdrawal.

You can exercise these rights by contacting us using the details provided in the “Contact Us” section below and specifying which privacy rights you wish to exercise. We must verify your identity in order to honor your request, which we will respond to within one (1) month. You may also access and update certain information (such as your contact details and saved addresses) by logging into your customer account on the Website. If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority, as described in the “Complaints” section below.

8. How We Protect Your Personal Data.

We take appropriate precautions including organizational, technical, administrative, and physical security measures to help safeguard your data against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure. While we have employed security technologies and procedures to assist safeguarding your personal data, no system or network can be guaranteed to be 100% secure. Due to the inherent nature of the internet, we cannot guarantee that data, including personal data, is absolutely safe from intrusion or other unauthorized access by others. We encourage you to take steps to protect your data and prevent unauthorized access to your password or account by, among other things, signing off after using a shared computer, choosing a robust password that nobody else knows or can easily guess, and keeping your log-in and password private. We are not responsible for any lost, stolen, or compromised passwords, or for any activity on your account via unauthorized password activity.

9. How Long We Retain Your Personal Data.

We may retain your data for as long as required to satisfy the purposes identified in this Policy and to meet legal requirements, including to process your orders, provide the Services, and handle after-sales matters; to comply with our legal, tax, and accounting obligations; to resolve disputes and enforce our agreements; and to detect and prevent fraud and abuse. We determine the appropriate retention period for personal data on the basis of the amount, nature, and sensitivity of the personal data being processed, the potential risk of harm from unauthorized use or disclosure of the personal data, whether we can achieve the purposes of the processing through other means, and on the basis of applicable legal requirements (such as applicable statutes of limitation). When personal data is no longer needed for these purposes, we will delete it, de-identify it, or aggregate it, in accordance with applicable law.

10. International Data Transfers.

Your personal data may be transferred to, stored, and processed in a country or jurisdiction other than the one in which it was collected, including in the United States and other jurisdictions in which we, our affiliates, or our service providers operate, and such jurisdictions may not have the same data protection laws as your jurisdiction. Where we transfer personal data originating in the European Economic Area (the “EEA”) or the United Kingdom to a country that has not been recognized as providing an adequate level of data protection, we rely on appropriate safeguards as required under the GDPR or the UK GDPR, such as the standard contractual clauses approved by the European Commission (supplemented, for transfers from the United Kingdom, by the UK International Data Transfer Addendum or the UK International Data Transfer Agreement). You may request a copy of the safeguards we use by contacting us as described in the “Contact Us” section below.

11. Third-Party Links and Services.

The Services may contain links to third-party websites such as social media sites, and also contain third-party plug-ins and functionalities. If you choose to use these sites or features, you may disclose your data not just to those third parties, but also to their users and the public more generally depending on how their services function. We are not responsible for the content or practices of those websites or services. The collection, use, and disclosure of your data will be subject to the privacy policies of the third-party websites or services, and not this Policy. We urge you to read the privacy and security policies of these third parties.

12. Children.

We do not knowingly collect or solicit personal data from anyone under the age of thirteen (13). If you are under thirteen (13), please do not attempt to register for the Services or send any personal data about yourself to us. If we learn that we have collected personal data from a child under the age of thirteen (13), we will delete such data as quickly as possible. If you believe that a child under thirteen (13) may have provided us personal data, please contact us by using the details provided in the “Contact Us” section below and we will take steps to delete their personal data from our systems. Our products are intended for purchase by adults (including parents and guardians). We do not knowingly “sell” or “share” (as those terms are defined under applicable U.S. state privacy laws) the personal information of consumers under sixteen (16) years of age.

13. Changes to Our Privacy Policy.

This Policy went into effect on the “Effective Date” and was last revised on the “Last Updated” date noted at the top of this page. We may update this Policy from time to time. When we do, we will notify you of any modifications to this Policy that might materially affect your rights or the way that we use or disclose your personal data prior to the change becoming effective, by means of a prominent notice on the Website home page. We encourage you to look for updates and changes to this Policy by checking the “Last Updated” date when you access the Website.

14. Complaints.

If you have complaints about how we process your personal information, please contact us using the contact details provided below. If you are not satisfied with our response to your complaint, depending on where you live you may have the right to appeal our decision by contacting us using the contact details set out below, or lodge your complaint with your local data protection authority. If you are located in the EEA or the United Kingdom, you also have the right to lodge a complaint with the data protection supervisory authority of the country in which you live or work or in which you consider an infringement of your rights occurred; in the United Kingdom, the supervisory authority is the Information Commissioner’s Office (ICO).

15. Contact Us.

We welcome your questions, comments, and concerns about privacy. You can contact us at:

Joyin US Corp, 17500 S 40th St, Phoenix, AZ 85048

support@joyin.co

APPENDIX — CALIFORNIA PRIVACY NOTICE

This Appendix supplements the Privacy Policy and applies solely to consumers who reside in the State of California. It is provided under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (together, the “CCPA”), and the regulations issued under it. Terms defined in the CCPA have the same meaning when used in this Appendix. This Appendix was last updated on the date stated at the top of the Privacy Policy.

A. Notice at Collection: Personal Information We Collect, Use, Disclose, Sell and Share

The table below describes, for the twelve (12) months preceding the date of this Appendix, the categories of personal information we have collected, the categories of sources from which we collected it, the business or commercial purposes for which we collect and use it, the categories of third parties to whom we disclose it for a business purpose, and whether we sell or share it. We collect these categories of personal information both online, through the Website, and offline, for example when you contact our customer service team.

The categories used below are those set out in the CCPA.

Categories of personal information collected (preceding 12 months)

Categories of sources

Business or commercial purposes for collection and use

Categories of third parties to whom disclosed for a business purpose

Sold or shared?

Identifiers, such as your name, billing and shipping address, email address, telephone number, ZIP code, order number, account identifier, IP address, and cookie and device identifiers

Directly from you; automatically from your device and browser; from our service providers

Providing the Services and fulfilling orders; creating, maintaining and authenticating your customer account; customer service and after-sales support; order, delivery and service notifications; marketing and advertising; security, fraud prevention, debugging and error correction; internal analytics and improvement of the Services; compliance with legal, tax and accounting obligations

E-commerce platform and website hosting providers; cloud service providers; payment processors; warehousing, fulfillment and delivery partners; customer service providers; email marketing service providers; our affiliates; professional advisors; and government authorities where required by law

Yes. We do not sell personal information for monetary consideration, but we share online identifiers and hashed email addresses with advertising and analytics partners for cross-context behavioral advertising. Categories of recipients: advertising networks, social media platforms and analytics providers.

Personal information described in subdivision (e) of Section 1798.80 of the California Civil Code, such as your name, address, telephone number, and limited payment information (card type and the last four digits of your card number). We do not collect or store full payment card numbers.

Directly from you; from our payment processors

Order processing, payment, refunds and chargebacks; fraud prevention; financial record-keeping; compliance with legal, tax and accounting obligations

E-commerce platform and website hosting providers; payment processors; warehousing, fulfillment and delivery partners; cloud service providers; professional advisors and auditors

No.

Commercial information, such as your order details and purchase history, products viewed or placed in your shopping cart, and discount codes or gift cards you redeem

Directly from you; automatically from your use of the Services

Order fulfillment and after-sales service; customer service; internal analytics and improvement of the Services; marketing and advertising

E-commerce platform and website hosting providers; cloud service providers; warehousing, fulfillment and delivery partners; analytics providers; email marketing service providers

Yes. Purchase and conversion events are transmitted to advertising and analytics partners for cross-context behavioral advertising. Categories of recipients: advertising networks, social media platforms and analytics providers.

Internet or other electronic network activity information, such as your browsing of and interaction with the Website, pages viewed, the pages or sources that refer you to the Website, search queries, and your engagement with our emails and advertisements

Automatically, through cookies, pixels and similar technologies; from our analytics and advertising providers

Operating, maintaining and improving the Website; measuring the performance of our marketing; internal analytics; security, fraud prevention and debugging; marketing and advertising

E-commerce platform and website hosting providers; cloud and content delivery network providers; analytics providers

Yes. Categories of recipients: advertising networks, social media platforms and analytics providers.

Geolocation data, limited to approximate location (such as your city, state, ZIP code or country) inferred from your IP address. We do not collect precise geolocation.

Automatically from your device and browser

Order processing and delivery; fraud prevention; internal analytics; delivering and localizing the Services

E-commerce platform and website hosting providers; cloud and content delivery network providers; analytics providers

No.

Audio, electronic, visual or similar information, limited to images, screenshots or other attachments you choose to submit to our customer service team

Directly from you

Customer service, after-sales support, returns and dispute resolution

Customer service providers; cloud service providers

No.

Inferences drawn from the above, such as your preferences, marketing segments and product interests

Derived by us from the information described above

Marketing and advertising; customer segmentation; improvement of the Services

Email marketing service providers; analytics providers; advertising partners

Yes, where such inferences are used to build or match advertising audiences. Categories of recipients: advertising networks and social media platforms.

Sensitive personal information

Not applicable

Not applicable

Not applicable

We do not collect sensitive personal information.

We do not collect the following categories of personal information: characteristics of protected classifications under California or federal law (such as race, gender, age or date of birth); biometric information; professional or employment-related information; education information; precise geolocation data; or genetic data. We do not purchase personal information from data brokers.

B. Sensitive Personal Information

We do not collect or process sensitive personal information as defined by the CCPA. Payment card details are collected and processed directly by our third-party payment processors; we do not collect account log-in credentials in combination with a password or security code, precise geolocation, or any other category of sensitive personal information. Because we do not use or disclose sensitive personal information for purposes other than those permitted under section 7027(m) of the CCPA Regulations, we are not required to, and do not, offer a separate “Limit the Use of My Sensitive Personal Information” option.

C. Sale and Sharing of Personal Information; Consumers Under 16

We do not sell personal information in exchange for monetary consideration. However, as described in the table above, we disclose online identifiers, internet or other electronic network activity information, commercial information, hashed contact information and inferences to advertising and analytics partners in connection with cross-context behavioral advertising. Under the CCPA, these disclosures may constitute a “sale” or “sharing” of personal information. The categories of third parties to whom personal information is sold or shared are advertising networks, social media platforms and analytics providers, and the business or commercial purpose of those disclosures is marketing and advertising, including measuring the performance of our advertising.

We do not have actual knowledge that we sell or share the personal information of consumers under sixteen (16) years of age. We do not knowingly collect personal information from children under thirteen (13). Because we do not sell or share the personal information of consumers we know to be under sixteen (16), we do not operate an opt-in process for consumers between thirteen (13) and sixteen (16) or for the parents or guardians of consumers under thirteen (13); should that change, we will obtain the affirmative authorization required by the CCPA before any such sale or sharing.

D. Retention

We retain each category of personal information described above for as long as reasonably necessary and proportionate to the purposes for which it was collected, as described in the “How Long We Retain Your Personal Data” section of the Privacy Policy. The criteria we use to determine retention periods include the nature and sensitivity of the information, the purposes for which we process it, and applicable legal, tax and accounting requirements, as well as periods necessary to resolve disputes and enforce our agreements. When personal information is no longer needed for these purposes, we delete, de-identify or aggregate it.

E. Your California Privacy Rights

If you are a California resident, you have the following rights, subject to the conditions, limitations and exceptions set out in the CCPA:

• Right to know: to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purpose for collecting, selling or sharing it, and the categories of third parties to whom we disclose, sell or share it.

• Right to access: to obtain a copy of the personal information we hold about you in a portable and, to the extent technically feasible, readily usable format.

• Right to delete: to request that we delete personal information we have collected from you, subject to the exceptions permitted by law (for example, where we must retain order and tax records).

• Right to correct: to request that we correct inaccurate personal information we maintain about you.

• Right to opt out of the sale or sharing of your personal information: to direct us not to sell or share your personal information, including for cross-context behavioral advertising.

• Right to limit the use and disclosure of sensitive personal information: as explained in Section B above, we do not collect sensitive personal information and do not use or disclose it beyond the purposes permitted by law, so no separate limitation option is offered.

• Right to non-discrimination and non-retaliation: we will not discriminate or retaliate against you for exercising any of your rights under the CCPA. We will not deny you goods or services, charge you a different price or rate, or provide you a different level or quality of goods or services because you exercised your rights.

F. How to Exercise Your Rights

You, or an authorized agent acting on your behalf, may submit a request to know, access, delete or correct your personal information by emailing us at support@joyin.co with the subject line “California Privacy Request.” Please describe the right you wish to exercise and provide enough information for us to locate your records, such as the name and email address used for your order and, where applicable, your order number. We do not charge a fee for responding to your request.

You may exercise your right to opt out of the sale or sharing of your personal information without creating an account, by any of the following methods: (i) using the “Do Not Sell or Share My Personal Information” link available in the footer of the Website; (ii) rejecting advertising cookies through the cookie banner or cookie settings tool on the Website; (iii) emailing us at support@joyin.co with the subject line “Do Not Sell or Share My Personal Information”; or (iv) transmitting an opt-out preference signal, as described below.

Opt-out preference signals. We recognize the Global Privacy Control (GPC) as a valid request to opt out of the sale and sharing of personal information. Where your browser or browser extension transmits a GPC signal, we process it in a frictionless manner: the signal is applied automatically to the browser and device from which it is sent, without requiring you to provide additional information, create an account, or take any further step, and we do not charge a fee or change your experience of the Website as a result. Because a GPC signal is tied to the browser or device, it will not be applied to any other browser or device, or to personal information associated with your customer account, unless you are logged in to that account when the signal is received. To learn how to enable GPC, please visit the website of your browser or extension provider.

Verification. Before responding to a request to know, delete or correct, we will take reasonable steps to verify your identity. We will generally verify your request by matching at least two data points you provide (for example, your name, the email address associated with your order, and your order number) against information already in our records. For a request to disclose specific pieces of personal information, we will require a higher degree of certainty, including the matching of at least three data points and a signed declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request. We use any additional information provided for verification purposes only, and delete it as soon as practicable after processing your request. If we cannot verify your identity, we will inform you and explain why. We will acknowledge receipt of your request within ten (10) business days and respond within forty-five (45) days, which we may extend by an additional forty-five (45) days where reasonably necessary after notifying you of the extension and the reasons for it.

Authorized agents. You may designate an authorized agent to submit a request on your behalf. The agent must provide us with written permission signed by you, or a valid power of attorney. Except where a power of attorney has been provided, we may also require you to verify your own identity directly with us and to confirm that you gave the agent permission to submit the request.

G. Data Reporting Requirements

We do not know, and have no reason to know, that we buy, receive for our commercial purposes, sell, share, or otherwise make available for commercial purposes the personal information of ten million (10,000,000) or more consumers in a calendar year. We are therefore not required to compile or disclose the annual request metrics that the CCPA Regulations require of businesses meeting that threshold.

H. Shine the Light

California Civil Code Section 1798.83 (the “Shine the Light” law) permits consumers who are California residents to request certain information regarding our disclosure of personal information to third parties for those third parties’ direct marketing purposes. We do not disclose personal information to third parties for those third parties’ own direct marketing purposes.

I. Contact Us

If you have questions about this Appendix, the Privacy Policy or our handling of personal information, or if you wish to submit a complaint, please contact us at Joyin US Corp, 14650 Meyer Canyon Dr, Fontana, CA 92336, United States, or by email at support@joyin.co.